acme-dns-client VS lego

In case you're not already familiar with it: one thing I'd recommend is using https://github.com/joohoi/acme-dns to obtain the certificates. You basically just point the subdomain you need wildcard certs for at that DNS server (a one time thing, ie you don't have to do this every three months), and the related tool https://github.com/acme-dns/acme-dns-client can get the certificates in a nice, automated, way without you ever having to expose the private reverse proxy to the Internet.

I also have domains on google domains and I use https://github.com/joohoi/acme-dns api to renew all the certificates using the api including wildcard certificates. Just register a new account at https://auth.acme-dns.io/register and start using DNS api. https://github.com/acme-dns/acme-dns-client

Self contained but hardly a tiny supply chain attack surface: https://github.com/go-acme/lego/blob/master/go.sum

This ACME client looks promising, but I haven’t tried it yet: https://github.com/go-acme/lego

My favorite method of obtaining certificates is with lets encrypt and LEGO

Caddy where possible, and acme.sh or lego where not.

Depend on host's capability... - lego - dehydrated - caddy - in case it already works as a web server, it will automatically issue and renew certs

u/gregtwallace maybe in the short term until you write your own, you could provide a hook into one of the many ACME client implementations which do DNS-01 and support the majority of major DNS provider APIs out of the box? That would make your (really great!) project much more widely usable.